Splunk Search

Why isn't my discard working?

timbCFCA
Path Finder

I'm trying to discard entries from one of my data sources and it isn't working. Why?
All the following are set on the indexer, not the universal forwarder. I've triple checked my work.

inputs.conf

[WinNetMon://inbound]
direction = inbound;outbound
disabled = 0
index = windows
packetType = accept;connect

props.conf

[WinNetMon://inbound]
TRANSFORMS-null1 = null1

transforms.conf

[null1]
SOURCE_KEY = LocalAddress
REGEX = ::1
DEST_KEY = queue
FORMAT = nullQueue

The events I'm getting are source=inbound and sourcetype=WinNetMon

Tags (1)
0 Karma

woodcock
Esteemed Legend

Your stanza header spec in props.conf is wrong. You have this:

 [WinNetMon://inbound]

You need something like this:

[MySourcetypeHere]

Or

[host::MyHostHere]

Or

[source::MySourceHere]

There are a few other uncommon specs, but I have never seen them used.

I am quite certain that your sourcetype is NOT WinNetMon://inbound and if it is, you should change it. You should have a line like this in your inputs.conf stanza

sourcetype = MySourcetypeHere
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

That regex will match any record that has a field called LocalAddress that contains the literal value "::1".

1) Verify the spelling and capitalization of the field.

2) Look at the events themselves and verify whether that is the internal representation in that field.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...